allowedChannelPlugins in local managed settings silently shadowed by remote org managed settings; skip message points at the ignored file

Summary

When remote (org/cloud) managed settings exist, allowedChannelPlugins set in the local /etc/claude-code/managed-settings.json is silently ignored — yet the channel-registration skip message explicitly tells the admin to "set allowedChannelPlugins in managed settings", which is exactly the file being shadowed. There is no warning that the local value was dropped.

Environment

• Claude Code 2.1.215 (also observed on 2.1.211), Linux (Ubuntu, kernel 6.17)
• Account: claude.ai Team plan (org has remote managed settings; locally cached at ~/.claude/remote-settings.json)
• Local managed settings at /etc/claude-code/managed-settings.json

Repro

1. Org remote managed settings contain (cached in ~/.claude/remote-settings.json):

``json
{ "channelsEnabled": true, "allowedChannelPlugins": [ { "marketplace": "claude-plugins-official", "plugin": "imessage" } ] }
``

1. Local /etc/claude-code/managed-settings.json contains:

``json
{ "channelsEnabled": true, "allowedChannelPlugins": [ { "plugin": "legion-chat", "marketplace": "hapticos-skills" } ] }
`
(shape verified against the settings zod schema in the 2.1.215 bundle: S.array(S.object({marketplace: S.string(), plugin: S.string()}))`)

1. Launch interactive: claude --channels plugin:legion-chat@hapticos-skills (plugin installed from that marketplace; declares experimental: { 'claude/channel': {} }).
2. MCP log shows:

``
Channel notifications skipped: plugin legion-chat@hapticos-skills is not on your org's approved channels list (set allowedChannelPlugins in managed settings)
``
even though the local managed settings do set it.

Same launch with --dangerously-load-development-channels registers and delivers fine (Channel notifications registered), so everything else in the chain is healthy.

Root cause (from reading the 2.1.215 bundle)

In the policy-settings loader, the admin tier is chosen as the first non-null of [remote managed settings, MDM, local managed-settings file], and only a handful of keys (allowManagedPermissionRulesOnly, forceLoginOrgUUID, allowedMcpServers, availableModels, sandbox.*) are combined across tiers. allowedChannelPlugins is not one of them, so when a remote tier exists it wholly replaces the local file's value. The channels gate then reads policySettings.allowedChannelPlugins and rejects with the message above.

Expected (any of)

• allowedChannelPlugins merged across managed tiers (or at least local honored when remote doesn't restrict), OR
• a startup warning that local managed-settings keys were shadowed by remote org settings, OR
• the skip message pointing at the remote org settings as the place to fix, when that's the tier that was used.

As-is, an admin can verify the local file byte-for-byte against the schema and still have it silently ignored, with the error message directing them back to the ignored file.